session variables no longer getting cleared by CSRF authenticity questions